Fix email() splitting on commas inside quoted strings when allowMultiple is enabled

[dahlia]

Summary

email({ allowMultiple: true }) used a naive input.split(",") to separate multiple email addresses, which broke valid inputs where commas appear inside quoted local parts or quoted display names. For example:

// Quoted local part with comma: should parse as two addresses
email({ allowMultiple: true }).parse('"a,b"@example.com, c@example.com');
// Before: fails on fragment `"a`
// After: succeeds with ['"a,b"@example.com', 'c@example.com']

// Display name with comma
email({ allowMultiple: true, allowDisplayName: true }).parse(
  '"Doe, John" <john@example.com>, jane@example.com',
);
// Before: fails on fragment `"Doe`
// After: succeeds with ['john@example.com', 'jane@example.com']

This PR replaces the naive split with a character-by-character splitter that tracks whether the current position is inside double quotes or angle brackets, and only treats commas outside those contexts as address separators. The splitter also respects backslash escapes inside quoted strings, so inputs like "a\",b"@example.com are handled correctly.

Closes #320

Test plan

• Added regression tests in packages/core/src/valueparser.test.ts for quoted local parts containing commas ("a,b"@...)
• Added regression tests for display names containing commas ("Doe, John" <...>)
• Added regression tests for backslash-escaped quotes followed by commas ("a\",b"@... and "Doe \", John" <...>)
• Verified all existing email parser tests continue to pass
• Ran mise test:deno (358 passed) and mise check (type check, lint, format, dry-run publish all clean)

[dahlia]

@codex review

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

The pull request addresses a bug in the email() parser where enabling allowMultiple led to incorrect splitting of email addresses. Previously, a simple split(",") was used, which failed when commas were present inside quoted sections of an email address. The fix introduces a more robust character-by-character parsing mechanism that correctly identifies email separators while respecting quoted strings and angle brackets, ensuring valid email addresses are parsed as intended.

Highlights

• Email Parsing Fix: Corrected the email() function's behavior when allowMultiple is enabled, preventing incorrect splitting of email addresses that contain commas within quoted local parts or display names.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.90%. Comparing base (c75c971) to head (d2447ab).
⚠️ Report is 21 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff            @@
##             main     #606    +/-   ##
========================================
  Coverage   94.89%   94.90%            
========================================
  Files          38       38            
  Lines       17271    17379   +108     
  Branches     4543     4580    +37     
========================================
+ Hits        16390    16494   +104     
- Misses        869      873     +4     
  Partials       12       12            

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6c4e1c00-610b-462a-b6e4-e4d5d92d68db

📥 Commits

Reviewing files that changed from the base of the PR and between e69670e and d2447ab.

📒 Files selected for processing (2)

• packages/core/src/valueparser.test.ts
• packages/core/src/valueparser.ts

---

Walkthrough

Replaces a naive comma split used when email(..., allowMultiple: true) with a new internal splitEmails(input: string) helper that respects quoted local-parts, escaped quotes, and angle-bracket display-name syntax. The email parsing path now calls splitEmails(...), trims each fragment, and validates addresses. Adds unit tests covering quoted local parts, escaped quotes, quoted display names, and commas inside display names when allowMultiple is true. No public API or exported signatures were changed.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main fix: preventing email() from splitting on commas inside quoted strings when allowMultiple is enabled.
Description check	✅ Passed	The description is comprehensive and directly related to the changeset, providing clear examples of the issue, the solution, and test coverage.
Linked Issues check	✅ Passed	The PR fully addresses issue #320 by implementing a character-by-character email splitter that respects quoted segments and angle brackets, with regression tests validating all documented use cases.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the email() splitting behavior: internal helper function, test cases, and documentation updates—no unrelated changes present.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-320-email-quoted-comma

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CHANGES.md`:
- Around line 426-427: Update the CHANGES.md entry for the email() allowMultiple
fix to explicitly state that quoted strings may appear in both the local part
and the display name; reword the bullet for the `email()` fix with
`allowMultiple` to something like "Fixed `email()` with `allowMultiple` to avoid
splitting on commas inside quoted local parts (e.g., \"a,b\"@example.com) and
inside quoted display names (e.g., \"Doe, John\" <john@example.com>), matching
the PR objective." Reference `email()` and `allowMultiple` so the change clearly
documents both quoted local parts and quoted display names.

In `@packages/core/src/valueparser.ts`:
- Around line 2969-3002: Add a short JSDoc above the splitEmails function
describing its purpose, parameters and return value: that splitEmails(input:
string) returns an array of comma-separated email chunks while being aware of
quoted strings, escaped characters, and angle-bracketed addresses; mention how
it treats backslash-escaped characters and that it preserves surrounding
characters (no trimming) and any important edge-cases (e.g., unbalanced
quotes/angles). Reference the function name splitEmails and the key local flags
in the description (inQuotes, inAngleBrackets, escaped) so future readers
understand the state machine and its behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 53b8191b-6f3f-44de-995a-03c981176ac2

📥 Commits

Reviewing files that changed from the base of the PR and between 83ad91e and 9e1ebe7.

📒 Files selected for processing (3)

• CHANGES.md
• packages/core/src/valueparser.test.ts
• packages/core/src/valueparser.ts

[gemini-code-assist]

Code Review

This pull request addresses an issue with the email() parser when allowMultiple is enabled, where it would incorrectly split on commas within quoted strings. The fix introduces a new splitEmails helper function that implements a character-by-character state machine to correctly handle quoted local parts, display names in angle brackets, and backslash-escaped characters. This approach is more robust than the previous String.prototype.split(',') method. The changes are well-tested with new regression tests covering various edge cases, ensuring the fix is effective and does not introduce new issues. The implementation is clean and adheres to the project's coding standards.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[dahlia]

@codex review

[dahlia]

/gemini review

[gemini-code-assist]

Code Review

This pull request effectively fixes the issue with parsing multiple email addresses that contain commas within quoted parts. The new splitEmails function correctly handles quoted local parts, display names, and escaped characters. The added tests are comprehensive and cover the relevant edge cases, ensuring the fix is robust. I have one minor suggestion to improve the readability of the new splitEmails function.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3bc1adea6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[dahlia]

@codex review

[dahlia]

/gemini review

[gemini-code-assist]

Code Review

This pull request effectively addresses an issue where multiple email addresses were not parsed correctly if they contained commas within quoted strings. The introduction of the splitEmails function, which performs a stateful split, is a robust solution to the problem. The new regression tests are comprehensive and cover various edge cases, including quoted local parts, display names, and escaped characters.

I have one minor suggestion to align the new helper function more closely with the repository's style guide regarding immutability.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e69670e9b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[dahlia]

@codex review

[dahlia]

/gemini review

[gemini-code-assist]

Code Review

This pull request addresses a bug in the email() value parser where multiple email addresses were not split correctly if they contained commas within quoted strings. The fix replaces a naive String.prototype.split() with a more robust, context-aware splitEmails helper function. This new function correctly handles quoted local parts and display names by iterating through the input and tracking whether it's inside quotes or angle brackets. The implementation is sound and is accompanied by a comprehensive set of regression tests covering various edge cases, including escaped quotes. The changes are well-contained and effectively resolve the issue.